CVE-2010-2055

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-07-22 · updated 2026-06-16
Weakness: CWE-17

Description

Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.

Affected products

Artifex Afpl Ghostscript: 6.0, 6.01, 6.50, 7.00, 7.03, 7.04 (+10)
Artifex Ghostscript Fonts: 6.0, 8.11
Artifex Gpl Ghostscript: through 8.71; 8.01, 8.15, 8.50, 8.51, 8.54, 8.56 (+7)

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583183
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583316
http://bugs.ghostscript.com/show_bug.cgi?id=691339
http://bugs.ghostscript.com/show_bug.cgi?id=691350
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043913.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043948.html
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
http://savannah.gnu.org/forum/forum.php?forum_id=6368
http://secunia.com/advisories/40452
http://secunia.com/advisories/40475
http://secunia.com/advisories/40532
http://security.gentoo.org/glsa/glsa-201412-17.xml

Get alerted when CVE-2010-2055 or the next vulnerability affects your stack